BruCON 0x0A

As desktop and server security keeps raising the baseline for successful exploitation,IOT devices are still stuck in the 1990's, despite their ubiquity in every home network. This, coupled with the ability to access them from anywhere is creating a time-bomb situation in which millions of households are left vulnerable, regardless of any network security posture. 

These topics will be examined using the "Circle with Disney" and Foscam devices as case studies. During the course of the vulnerability testing of these devices, over 50 CVEs were discovered, out of which, discussion will focus on the more novel attack techniques seen within the Disney Circle, including: 
- SSL certificate Attribute validation bypasses 
- SSID Broadcasting injection 
- Use-Between-Realloc Memory Corruption. 
- Cloud Routing Abuse 

Finally, there will be discussion IOT device's use of traditionally offensive tools (arp-poisoning, backdoors, and beaconing) for central functionality.